专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

US20120023486A1 Verification of Information-Flow Downgraders 失效
标题翻译：信息流降级的验证
公开(公告)号：US20120023486A1
公开(公告)日：2012-01-26
申请号：US12843308
申请日：2010-07-26
申请人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F9/44
CPC分类号： G06F21/577 , H04L63/105
摘要： A method includes determining grammar for output of an information-flow downgrader in a software program. The software program directs the output of the information-flow downgrader to a sink. The method includes determining whether the grammar of the output conforms to one or more predetermined specifications of the sink. The method includes, in response to a determination the grammar of the output conforms to the one or more predetermined specifications of the sink, determining the information-flow downgrader is verified for the sink, wherein determining grammar, determining whether the grammar, and determining the information-flow downgrader are performed via static analysis of the software program. Apparatus and computer program products are also disclosed. An apparatus includes a user interface providing a result of whether or not output of an information-flow downgrader in the software program conforms to one or more predetermined specifications of a sink in the software program.
摘要翻译：一种方法包括在软件程序中确定信息流降级器的输出的语法。软件程序将信息流降级器的输出引导到宿。该方法包括确定输出的语法是否符合汇的一个或多个预定规范。该方法包括响应于确定，输出的语法符合信宿的一个或多个预定规范，确定信宿流降级器对于汇点进行验证，其中确定语法，确定语法，并确定信息流降级器通过软件程序的静态分析来执行。还公开了装置和计算机程序产品。一种装置，包括提供软件程序中的信息流下载器的输出是否符合软件程序中的接收器的一个或多个预定规格的结果的用户界面。

2. 发明授权

US08528095B2 Injection context based static analysis of computer software applications 有权
标题翻译：基于注入场景的静态分析计算机软件应用
公开(公告)号：US08528095B2
公开(公告)日：2013-09-03
申请号：US12825293
申请日：2010-06-28
申请人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F11/00 , H04L9/32 , G06F15/173 , G06F9/44
CPC分类号： G06F11/3604 , G06F8/75 , G06F21/577
摘要： Embodiments of the invention generally relate to injection context based static analysis of computer software applications. Embodiments of the invention may include selecting a sink within a computer software application, tracing a character output stream leading to the sink within the computer software application, determining an injection context of the character output stream at the sink, where the injection context is predefined in association with a state of the character output stream at the sink, identifying any actions that have been predefined in association with the identified injection context, and providing a report of the actions.
摘要翻译：本发明的实施例一般涉及计算机软件应用的基于注入上下文的静态分析。本发明的实施例可以包括选择计算机软件应用程序内的汇点，跟踪通向计算机软件应用程序内的汇点的字符输出流，确定汇点处的字符输出流的注入上下文，其中注入上下文在与汇点处的字符输出流的状态相关联，识别已经与所识别的注入上下文相关联地预定义的任何动作，以及提供动作的报告。

3. 发明授权

US08468605B2 Identifying security vulnerability in computer software 有权
标题翻译：识别计算机软件中的安全漏洞
公开(公告)号：US08468605B2
公开(公告)日：2013-06-18
申请号：US12627351
申请日：2009-11-30
申请人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F12/14 , G06F12/16 , G06F11/00 , G08B23/00 , G06F11/30 , G06F9/44
CPC分类号： G06F21/566
摘要： Identifying a security vulnerability in a computer software application by identifying at least one source in a computer software application, identifying at least one sink in the computer software application, identifying at least one input to any of the sinks, determining whether the input derives its value directly or indirectly from any of the sources, determining a set of possible values for the input, and identifying a security vulnerability where the set of possible values for the input does not match a predefined specification of legal values associated with the sink input.
摘要翻译：通过识别计算机软件应用中的至少一个源来识别计算机软件应用中的安全漏洞，识别计算机软件应用中的至少一个接收器，识别任何接收器的至少一个输入，确定输入是否导出其值直接或间接地从任何来源确定输入的一组可能的值，以及识别安全漏洞，其中输入的可能值的集合不与预定义的与接收器输入相关联的合法值的规范相匹配。

4. 发明授权

US08584246B2 Eliminating false reports of security vulnerabilities when testing computer software 失效
标题翻译：在测试计算机软件时，消除安全漏洞的虚假报告
公开(公告)号：US08584246B2
公开(公告)日：2013-11-12
申请号：US12578013
申请日：2009-10-13
申请人： Yinnon Avraham Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon Avraham Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F12/14
CPC分类号： G06F21/57 , G06F11/3692
摘要： A system for eliminating false reports of security vulnerabilities when testing computer software, including a taint analysis engine configured to identify a tainted variable v in a computer application, a data mapping identification engine configured to identify a variable x within the application that holds data derived from v, where x is in a different format than v, an AddData identification engine configured to identify an AddData operation within the application that is performed on x, a signature identification engine configured to identify a Sign operation within the application that is performed on the results of the AddData operation on x, a signature comparison identification engine configured to identify an operation within the application that compares the results of the Sign operation with another value.
摘要翻译：一种用于在测试计算机软件时消除安全漏洞的虚假报告的系统，包括配置成识别计算机应用程序中的受污染变量v的污染分析引擎，配置为识别应用程序内的变量x，该变量x保存从 v，其中x与v不同的格式，被配置为识别在x上执行的应用程序内的AddData操作的AddData识别引擎，被配置为识别在结果上执行的应用程序内的签名操作的签名识别引擎的签名比较识别引擎，所述签名比较识别引擎被配置为识别应用程序内将所述Sign操作的结果与另一值进行比较的操作。

5. 发明授权

US09275246B2 System and method for static detection and categorization of information-flow downgraders 有权
标题翻译：信息流降级的静态检测和分类的系统和方法
公开(公告)号：US09275246B2
公开(公告)日：2016-03-01
申请号：US12575647
申请日：2009-10-08
申请人： Yinnon Haviv , Roee Hay , Marco Pistoia , Guy Podjarny , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon Haviv , Roee Hay , Marco Pistoia , Guy Podjarny , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F17/30 , G06F7/00 , G06F21/62 , G06F9/45 , G06F11/36
CPC分类号： H04L63/1416 , G06F8/49 , G06F11/3608 , G06F21/6218
摘要： A system and method for static detection and categorization of information-flow downgraders includes transforming a program stored in a memory device by statically analyzing program variables to yield a single assignment to each variable in an instruction set. The instruction set is translated to production rules with string operations. A context-free grammar is generated from the production rules to identify a finite set of strings. An information-flow downgrader function is identified by checking the finite set of strings against one or more function specifications.
摘要翻译：用于信息流降级器的静态检测和分类的系统和方法包括通过静态分析程序变量来变换存储在存储器件中的程序，以产生对指令集中的每个变量的单个赋值。指令集被转换为具有字符串操作的生产规则。从生产规则生成上下文无关的语法，以识别有限的字符串集。通过根据一个或多个功能规范检查有限的字符串来识别信息流降级功能。

6. 发明授权

US08635602B2 Verification of information-flow downgraders 失效
标题翻译：验证信息流下载
公开(公告)号：US08635602B2
公开(公告)日：2014-01-21
申请号：US12843308
申请日：2010-07-26
申请人： Yinnon Avraham Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon Avraham Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F9/44
CPC分类号： G06F21/577 , H04L63/105
摘要： A method includes determining grammar for output of an information-flow downgrader in a software program. The software program directs the output of the information-flow downgrader to a sink. The method includes determining whether the grammar of the output conforms to one or more predetermined specifications of the sink. The method includes, in response to a determination the grammar of the output conforms to the one or more predetermined specifications of the sink, determining the information-flow downgrader is verified for the sink, wherein determining grammar, determining whether the grammar, and determining the information-flow downgrader are performed via static analysis of the software program. Apparatus and computer program products are also disclosed. An apparatus includes a user interface providing a result of whether or not output of an information-flow downgrader in the software program conforms to one or more predetermined specifications of a sink in the software program.
摘要翻译：一种方法包括在软件程序中确定信息流降级器的输出的语法。软件程序将信息流降级器的输出引导到宿。该方法包括确定输出的语法是否符合汇的一个或多个预定规范。该方法包括响应于确定，输出的语法符合信宿的一个或多个预定规范，确定信宿流降级器对于汇点进行验证，其中确定语法，确定语法，并确定信息流降级器通过软件程序的静态分析来执行。还公开了装置和计算机程序产品。一种装置，包括提供软件程序中的信息流下载器的输出是否符合软件程序中的接收器的一个或多个预定规格的结果的用户界面。

7. 发明申请

US20110088023A1 SYSTEM AND METHOD FOR STATIC DETECTION AND CATEGORIZATION OF INFORMATION-FLOW DOWNGRADERS 有权
标题翻译：用于静态检测和分类信息流下载器的系统和方法
公开(公告)号：US20110088023A1
公开(公告)日：2011-04-14
申请号：US12575647
申请日：2009-10-08
申请人： YINNON HAVIV , Roee Hay , Marco Pistoia , Guy Podjarny , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： YINNON HAVIV , Roee Hay , Marco Pistoia , Guy Podjarny , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F9/45
CPC分类号： H04L63/1416 , G06F8/49 , G06F11/3608 , G06F21/6218
摘要： A system and method for static detection and categorization of information-flow downgraders includes transforming a program stored in a memory device by statically analyzing program variables to yield a single assignment to each variable in an instruction set. The instruction set is translated to production rules with string operations. A context-free grammar is generated from the production rules to identify a finite set of strings. An information-flow downgrader function is identified by checking the finite set of strings against one or more function specifications.
摘要翻译：用于信息流降级器的静态检测和分类的系统和方法包括通过静态分析程序变量来变换存储在存储器件中的程序，以产生对指令集中的每个变量的单个赋值。指令集被转换为具有字符串操作的生产规则。从生产规则生成上下文无关的语法，以识别有限的字符串集。通过根据一个或多个功能规范检查有限的字符串来识别信息流降级功能。

8. 发明申请

US20120215757A1 WEB CRAWLING USING STATIC ANALYSIS 审中-公开
标题翻译：使用静态分析的WEB抓取
公开(公告)号：US20120215757A1
公开(公告)日：2012-08-23
申请号：US13032638
申请日：2011-02-22
申请人： Omri Weisman , Yinnon Avraham Haviv , Adi Sharabani , Omer Tripp , Marco Pistoia , Takaaki Tateishi , Guy Podjarny
发明人： Omri Weisman , Yinnon Avraham Haviv , Adi Sharabani , Omer Tripp , Marco Pistoia , Takaaki Tateishi , Guy Podjarny
IPC分类号： G06F17/30
CPC分类号： G06F16/951
摘要： A crawler including a document retriever configured to retrieve a first computer-based document, a link identifier configured to identify an actual string within the computer-based document as being a hyperlink-type string, and a static analyzer configured to perform static analysis of an operation on a variable within the first computer-based document to identify a possible string value of the variable as being a hyperlink-type string, where any of the strings indicate a location of at least a second computer-based document.
摘要翻译：包括被配置为检索第一基于计算机的文档的文档检索器的爬行器，被配置为将所述基于计算机的文档内的实际字符串标识为超链接字符串的链接标识符和被配置为执行静态分析的静态分析器操作第一基于计算机的文档中的变量，以将变量的可能字符串值标识为超链接类型的字符串，其中任何字符串指示至少第二基于计算机的文档的位置。

9. 发明授权

US08533694B2 Identification of read/write chains during static analysis of computer software 有权
标题翻译：在计算机软件的静态分析期间识别读/写链
公开(公告)号：US08533694B2
公开(公告)日：2013-09-10
申请号：US12129894
申请日：2008-05-30
申请人： Marco Pistoia , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Marco Pistoia , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F9/45 , G06F7/00 , G06F17/30
CPC分类号： G06F8/433
摘要： A system for identifying read/write chains in computer software, including a static analysis engine identifying within computer software logical container accesses, a string analyzer configured to at least partly resolve any variables identifying the logical container in any of the accesses by determining a set of potential values of any of the variables, and a Logical Container Access Virtualization component (LCAV) configured to identify the type and scope of any permutations of the accesses, where each of the permutations is defined by substituting any of the potential values for any of the access variables, and identify any read/write chains within the computer software by matching any of the access permutations that read from the logical container with any of the access permutations that write to the logical container if there is an intersection between the scopes of the read and write access permutations.
摘要翻译：一种用于识别计算机软件中的读/写链的系统，包括在计算机软件逻辑容器访问内识别的静态分析引擎，串行分析器，其被配置为至少部分地解析任何访问中识别逻辑容器的任何变量，任何变量的潜在值和逻辑容器访问虚拟化组件（LCAV），其被配置为识别访问的任何排列的类型和范围，其中每个排列通过将任何潜在值替换为任何访问变量，并通过将从逻辑容器读取的任何访问排列与写入逻辑容器的任何访问排列进行匹配，以识别计算机软件中的任何读/写链，如果读取范围之间存在交集并写入访问排列。

10. 发明申请

US20090300266A1 IDENTIFICATION OF READ/WRITE CHAINS DURING STATIC ANALYSIS OF COMPUTER SOFTWARE 有权
标题翻译：计算机软件静态分析期间读/写链的识别
公开(公告)号：US20090300266A1
公开(公告)日：2009-12-03
申请号：US12129894
申请日：2008-05-30
申请人： Marco Pistoia , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Marco Pistoia , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F12/00
CPC分类号： G06F8/433
摘要： A system for identifying read/write chains in computer software, including a static analysis engine identifying within computer software logical container accesses, a string analyzer configured to at least partly resolve any variables identifying the logical container in any of the accesses by determining a set of potential values of any of the variables, and a Logical Container Access Virtualization component (LCAV) configured to identify the type and scope of any permutations of the accesses, where each of the permutations is defined by substituting any of the potential values for any of the access variables, and identify any read/write chains within the computer software by matching any of the access permutations that read from the logical container with any of the access permutations that write to the logical container if there is an intersection between the scopes of the read and write access permutations.
摘要翻译：一种用于识别计算机软件中的读/写链的系统，包括在计算机软件逻辑容器访问内识别的静态分析引擎，串行分析器，其被配置为至少部分地解析任何访问中识别逻辑容器的任何变量，任何变量的潜在值和逻辑容器访问虚拟化组件（LCAV），其被配置为识别访问的任何排列的类型和范围，其中每个排列通过将任何潜在值替换为任何访问变量，并通过将从逻辑容器读取的任何访问排列与写入逻辑容器的任何访问排列进行匹配，以识别计算机软件中的任何读/写链，如果读取范围之间存在交集并写入访问排列。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式